1. General provisions
1.1. This Privacy Policy (the “Policy”) governs the processing of personal data of users of the Sonomo mobile application for Android, package name dev.odisar.sonomo (the “App”), distributed through Google Play.
1.2. The controller of personal data is Individual Entrepreneur Serhii Oleksandrovych Mykhailenko, registered in Ukraine and operating under the ODISAR brand (the “Controller”). Contact address for all matters relating to personal data: admin@odisar.dev.
1.3. Personal data is processed in accordance with the Law of Ukraine “On Personal Data Protection” No. 2297-VI and, with respect to users located in the European Economic Area and the United Kingdom, Regulation (EU) 2016/679 (the “GDPR”) and the UK GDPR.
1.4. The App does not provide for user registration. The Controller does not request and does not receive the user’s name, email address, telephone number or other data that directly identifies the user.
The English version of this Policy is authoritative. The Ukrainian version is a translation.
2. Categories of data processed
2.1. Usage statistics. On first launch the App generates a random installation identifier (a 32-character string) that is not derived from the device, the Google account or the advertising ID. The App transmits the following events to the Controller’s server together with this identifier:
- opening of an episode or book chapter — episode identifier, language of study, interface language;
- completion of an episode — episode identifier, playback position in seconds;
- saving a word to the vocabulary — the dictionary form of the word;
- selection of languages during initial setup — language of study, interface language.
Each event is stored with the time of receipt. The IP address is not stored with these events.
2.2. Technical data of network requests. When the App downloads the catalogue, episode texts, audio files and images, the Controller’s server receives the IP address, the date and time of the request, the address of the requested resource and the technical headers of the HTTP client. This data is recorded in web-server logs.
2.3. Push notification identifiers. The App uses Firebase Cloud Messaging, a service of Google, to deliver notifications about new episodes. For this purpose Google processes the Firebase installation ID, the push token of the App installation and technical data of the installation (App version, operating system and SDK versions), and the App subscribes to a notification topic corresponding to the interface language. The Controller’s server does not receive or store these identifiers. Notifications are displayed only if the user has granted the Android notification permission.
2.4. Subscription data. Payments for subscriptions are processed by Google through Google Play Billing. Subscription status is verified through the RevenueCat service. In connection with a purchase the Controller and RevenueCat process: an anonymous customer identifier generated by the App, the Google Play purchase token and order number, the product identifier, subscription status and dates, price, currency and store country, and technical data of the installation (App version, operating system version, device model, locale). Google Play does not disclose the purchaser’s name, email address or payment instrument details to the Controller or to RevenueCat.
2.5. Data stored on the device only. The optional nickname, saved words, listening progress, training results and settings are stored in the App’s local storage and are not transmitted to the Controller. Where Android backup is enabled on the device, the operating system may include this data and the installation identifier referred to in clause 2.1 in the backup of the user’s Google account and restore it upon reinstallation; such backup is performed by Google under the user’s control. Words submitted for pronunciation are passed by the App to the text-to-speech engine installed on the device and selected in the Android settings; the Controller does not receive this data, and its further processing is governed by the privacy policy of the provider of that engine.
2.6. Data that is not collected. The App does not collect location data, contacts, photos or files, microphone or camera input, the advertising ID or a list of installed applications. The App contains no advertising and no third-party advertising or analytics SDKs. The Controller does not carry out profiling or automated decision-making that produces legal or similarly significant effects.
3. Purposes and legal bases
3.1. Personal data is processed for the following purposes and on the following legal bases:
- provision of App content (data referred to in clause 2.2) — performance of a contract with the user, GDPR Art. 6(1)(b);
- provision and verification of the subscription (data referred to in clause 2.4) — performance of a contract, Art. 6(1)(b); record-keeping of transactions — compliance with legal obligations under tax and accounting law, Art. 6(1)(c);
- notification of new content (data referred to in clause 2.3) — the Controller’s legitimate interest in informing users about new episodes, Art. 6(1)(f);
- analysis of content usage (data referred to in clause 2.1) — the Controller’s legitimate interest in assessing demand for episodes and improving content, Art. 6(1)(f). The data is limited to the events listed in clause 2.1, is not combined with other data and is not used for advertising;
- security and stable operation of the server (data referred to in clause 2.2) — the Controller’s legitimate interest, Art. 6(1)(f).
3.2. The provision of personal data is not a statutory requirement. The data referred to in clause 2.2 is technically necessary for the App to function; the data referred to in clause 2.4 is necessary to provide access to paid content.
4. Recipients of data
4.1. The Controller does not sell personal data and does not disclose it to third parties for advertising or marketing purposes.
4.2. The following processors process data on behalf of the Controller under data processing agreements:
- Google LLC (USA) and its affiliates — Firebase Cloud Messaging: delivery of push notifications; data received: Firebase installation ID, push token, notification topic, technical data of the installation. Privacy and Security in Firebase;
- RevenueCat, Inc. (USA) — verification of purchases and subscription status; data received: the subscription data listed in clause 2.4. RevenueCat Privacy Policy;
- Hostinger International Ltd. (Cyprus) — hosting of the Controller’s server and database, located in the European Union; data stored: usage statistics (clause 2.1) and web-server logs (clause 2.2).
4.3. Distribution of the App and processing of payments are carried out by Google (Google LLC, Google Ireland Limited, Google Commerce Limited) as an independent controller in accordance with the Google Privacy Policy.
5. International transfers
5.1. The Controller is established in Ukraine. The data referred to in clauses 2.1 and 2.2 is stored on a server located in the European Union.
5.2. The processors referred to in clause 4.2 may process data in the United States and other countries. Such transfers are made on the basis of the European Commission’s adequacy decision for the EU–US Data Privacy Framework, where the recipient is certified under it, or the Standard Contractual Clauses approved by the European Commission and incorporated into the data processing agreements with these processors.
6. Retention and deletion
6.1. Personal data is retained for the following periods:
- usage statistics (clause 2.1) — 90 days from the date of receipt, after which the records are deleted;
- web-server logs (clause 2.2) — no longer than 30 days;
- subscription data (clause 2.4) — for the term of the subscription and thereafter for the period prescribed by tax and accounting law;
- push notification identifiers (clause 2.3) — retained by Google until the App is uninstalled or the installation becomes inactive, in accordance with Google’s retention rules;
- data stored on the device (clause 2.5) — until the user clears the App’s storage or uninstalls the App.
6.2. Data is deleted as follows:
- usage statistics and web-server logs are deleted automatically upon expiry of the periods specified in clause 6.1; deletion of usage statistics before that date on request is subject to clause 7.3;
- subscription data is deleted from the Controller’s and RevenueCat’s records at the user’s request sent in accordance with clause 7.2, except for transaction records that must be retained under tax and accounting law;
- data stored on the device and the installation identifier are deleted by the user by clearing the App’s storage or uninstalling the App; a copy contained in an Android backup is deleted by the user in the Google account settings;
- push notification identifiers are deleted by Google after the App is uninstalled.
6.3. The App does not provide for the creation of user accounts; accordingly, there is no account to be deleted.
7. Rights of data subjects
7.1. Subject to applicable law, the user has the right to:
- obtain information about the processing of their personal data and access to such data;
- obtain rectification of inaccurate data;
- obtain erasure of data;
- obtain restriction of processing;
- object to processing based on legitimate interest (GDPR Art. 21);
- receive their data in a structured, machine-readable format (data portability);
- lodge a complaint with a supervisory authority.
7.2. Requests are to be sent to admin@odisar.dev. A request is answered within one month of receipt. A request concerning subscription data must include the Google Play order number (format “GPA.XXXX-XXXX-XXXX-XXXXX”), which enables the relevant record to be identified.
7.3. The usage statistics referred to in clause 2.1 are not linked to a name, email address or Google account, and the Controller is not in a position to identify the data subject to whom particular records relate. In accordance with GDPR Art. 11, the rights of access, rectification, erasure, restriction and portability apply to such records only where the data subject provides additional information enabling their identification.
7.4. The user may independently:
- disable notifications — Android settings → Apps → Sonomo → Notifications;
- erase local data and reset the installation identifier — Android settings → Apps → Sonomo → Storage → Clear storage;
- cancel the subscription — Google Play → Payments and subscriptions → Subscriptions.
7.5. The supervisory authority in Ukraine is the Ukrainian Parliament Commissioner for Human Rights. Users located in the European Economic Area or the United Kingdom may also lodge a complaint with the data protection authority of their country of residence.
8. Additional information for residents of the United States
8.1. The Controller does not sell personal information and does not share it for cross-context behavioural advertising, and has not done so in the preceding 12 months.
8.2. The categories of personal information processed are: identifiers (installation identifier, anonymous customer identifier, IP address), commercial information (subscription purchases) and information on activity in the App. The purposes of processing are set out in section 3; the recipients are set out in section 4.
8.3. Requests to know, delete or correct personal information are accepted at the address specified in clause 7.2. Exercising these rights does not result in discriminatory treatment.
8.4. The App does not track users across third-party applications or websites and does not respond to “Do Not Track” signals.
9. Children
9.1. The App is intended for a general audience and is not directed to children under the age of 13. The Controller does not knowingly collect personal data of children under 13.
9.2. A parent or legal guardian who believes that a child has provided personal data through the App may contact the Controller at the address specified in clause 7.2; such data will be deleted.
10. Security of processing
The Controller applies technical and organisational measures appropriate to the risk, including: encryption of data in transit between the App and the servers (HTTPS/TLS); restriction of access to the server and the database to authorised persons; minimisation of the data collected; and time-limited retention in accordance with section 6.
11. Changes to this Policy
The Controller may amend this Policy when the composition of data processed, the purposes of processing or applicable law change. The current version is published on this page with its effective date. Users are informed of material changes in the App or in its Google Play listing before such changes take effect.
12. Contact details
Controller: Individual Entrepreneur Serhii Oleksandrovych Mykhailenko, Ukraine.
Email: admin@odisar.dev